Everything the series has taught so far, assembled into one network you can actually build — in Packet Tracer, GNS3, or a pile of used switches. Two access switches, two Layer-3 cores sharing a gateway with HSRP, an LACP interlink, Rapid-PVST roots aligned with the active gateway, and a NAT edge. Then we break it on purpose and watch it survive.
Every post so far configured one technology in isolation. Real networks are where they meet — and where the interactions bite. This is the first of four lab scenarios that close the series: a collapsed-core campus, the design that fits 90% of hotels, clinics, and offices. Two Layer-3 switches are core and distribution at once; access switches dual-home into both; a router does internet, DHCP, and NAT. Every box has a redundant path, and the failure of any single device or cable is survivable.
You can build this entire topology in Cisco Packet Tracer (free with a NetAcad account) with two 3650s, two 2960s, and a 2911 — every command in this post works there. It also builds unchanged in GNS3/CML or on used hardware. Follow the build order, run every verification, then do the failure drills at the end — pulling cables is the whole point of a lab.
01
Ten minutes of addressing plan saves two hours of "why can't VLAN 20 reach anything". Write the whole thing down first — in a real job this table IS the design document.
| VLAN | Purpose / subnet / gateway (HSRP VIP) |
|---|---|
| 10 — STAFF | 10.10.10.0/24 · VIP 10.10.10.1 · CORE-1 active |
| 20 — GUEST | 10.10.20.0/24 · VIP 10.10.20.1 · CORE-2 active |
| 30 — VOICE | 10.10.30.0/24 · VIP 10.10.30.1 · CORE-2 active |
| 99 — MGMT | 10.10.99.0/24 · VIP 10.10.99.1 · CORE-1 active |
| Link / interface | Addressing |
|---|---|
| EDGE G0/0 → Internet | 203.0.113.2/30 (ISP gateway .1) |
| EDGE G0/1 ↔ CORE-1 G1/0/24 | 10.255.0.0/30 — EDGE .1, CORE-1 .2 (routed port) |
| EDGE G0/2 ↔ CORE-2 G1/0/24 | 10.255.0.4/30 — EDGE .5, CORE-2 .6 (routed port) |
| CORE-1 ↔ CORE-2 | Po1 = G1/0/23 + G1/0/22, LACP 802.1Q trunk, all VLANs |
| Cores → access | CORE-x G1/0/1 → ACC-1 G0/1 · G1/0/2 → ACC-2 G0/1/2 — trunks |
| SVIs | CORE-1 = .2 in every VLAN, CORE-2 = .3, VIP = .1 |
Bring the network up in dependency order and verify each layer before starting the next: (1) cable everything and name the devices, (2) access layer — VLANs, trunks, access ports, (3) core L2 — the port-channel and STP roots, (4) core L3 — SVIs and HSRP, (5) edge — routed links, routes, DHCP, NAT. When something breaks during step 5, you already know layers 1–4 are good — that discipline is most of real troubleshooting.
02
Straight out of parts 2 and 6: define the VLANs, trunk the uplinks to both cores, and give every user port PortFast, BPDU Guard, and a voice VLAN.
ACC-1(config)# vlan 10 ACC-1(config-vlan)# name STAFF ACC-1(config-vlan)# vlan 20 ACC-1(config-vlan)# name GUEST ACC-1(config-vlan)# vlan 30 ACC-1(config-vlan)# name VOICE ACC-1(config-vlan)# vlan 99 ACC-1(config-vlan)# name MGMT ACC-1(config-vlan)# exit # Uplinks to BOTH cores — trunks, native VLAN moved off 1 ACC-1(config)# interface range GigabitEthernet0/1 - 2 ACC-1(config-if-range)# switchport mode trunk ACC-1(config-if-range)# switchport trunk native vlan 99 ACC-1(config-if-range)# switchport trunk allowed vlan 10,20,30,99 # Staff ports: data VLAN 10 + phones on VLAN 30 ACC-1(config)# interface range FastEthernet0/1 - 12 ACC-1(config-if-range)# switchport mode access ACC-1(config-if-range)# switchport access vlan 10 ACC-1(config-if-range)# switchport voice vlan 30 ACC-1(config-if-range)# spanning-tree portfast ACC-1(config-if-range)# spanning-tree bpduguard enable # Guest ports ACC-1(config)# interface range FastEthernet0/13 - 24 ACC-1(config-if-range)# switchport mode access ACC-1(config-if-range)# switchport access vlan 20 ACC-1(config-if-range)# spanning-tree portfast ACC-1(config-if-range)# spanning-tree bpduguard enable # Management SVI so you can SSH to the access switch itself ACC-1(config)# interface vlan 99 ACC-1(config-if)# ip address 10.10.99.11 255.255.255.0 ACC-1(config)# ip default-gateway 10.10.99.1
Copy-pasting ACC-1's config onto ACC-2 is the classic lab shortcut — and it silently duplicates 10.10.99.11. Give ACC-2 10.10.99.12. In Packet Tracer a duplicate IP just makes SSH land on the wrong box; on a real site it takes both switches off the management network intermittently, which is a miserable thing to debug remotely.
03
Bundle two links between the cores with LACP, switch everything to Rapid-PVST, and nail each VLAN's root bridge to the core that will also be its HSRP active gateway.
# Same VLAN definitions as the access layer first (vlan 10,20,30,99) # Two physical links → one logical trunk CORE-1(config)# interface range GigabitEthernet1/0/22 - 23 CORE-1(config-if-range)# channel-group 1 mode active CORE-1(config-if-range)# exit CORE-1(config)# interface Port-channel1 CORE-1(config-if)# switchport mode trunk CORE-1(config-if)# switchport trunk native vlan 99 CORE-1(config-if)# switchport trunk allowed vlan 10,20,30,99 # Downlinks to the access switches — same trunk settings CORE-1(config)# interface range GigabitEthernet1/0/1 - 2 CORE-1(config-if-range)# switchport mode trunk CORE-1(config-if-range)# switchport trunk native vlan 99 CORE-1(config-if-range)# switchport trunk allowed vlan 10,20,30,99 # Rapid-PVST everywhere (run on all four switches) CORE-1(config)# spanning-tree mode rapid-pvst # CORE-1 is root for the VLANs it will be HSRP-active for… CORE-1(config)# spanning-tree vlan 10,99 root primary CORE-1(config)# spanning-tree vlan 20,30 root secondary # …and CORE-2 mirrors it: CORE-2(config)# spanning-tree vlan 20,30 root primary CORE-2(config)# spanning-tree vlan 10,99 root secondary CORE-1# show etherchannel summary | include Po1 1 Po1(SU) LACP Gi1/0/22(P) Gi1/0/23(P)
If CORE-2 is the STP root for VLAN 10 but CORE-1 is its HSRP active gateway, every packet from ACC-1's staff ports travels ACC-1 → CORE-2 → across Po1 → CORE-1 — an extra hop for all traffic, forever, invisibly. Aligning root and active per VLAN (10/99 on CORE-1, 20/30 on CORE-2) means each frame's Layer-2 shortest path ends exactly where its Layer-3 gateway lives. This alignment is the single most-skipped step in real campus deployments we audit.
04
Turn the cores into routers: an SVI per VLAN, an HSRP group per VLAN with the VIP the clients will use, preemption on, and priorities matching the STP plan.
CORE-1(config)# ip routing ← the line everyone forgets on a switch CORE-1(config)# interface vlan 10 CORE-1(config-if)# ip address 10.10.10.2 255.255.255.0 CORE-1(config-if)# standby 10 ip 10.10.10.1 CORE-1(config-if)# standby 10 priority 110 CORE-1(config-if)# standby 10 preempt # VLAN 99 identical (priority 110 here too). # VLANs 20 and 30: same recipe but priority 90 — CORE-2 gets 110 for those. # DHCP relay on every SVI — pools live on EDGE (section 05) CORE-1(config)# interface vlan 10 CORE-1(config-if)# ip helper-address 10.255.0.1 # …repeat on VLANs 20/30/99 on BOTH cores # (CORE-2 relays to its own uplink peer, 10.255.0.5) CORE-1# show standby brief Interface Grp Pri P State Active Standby Virtual IP Vl10 10 110 P Active local 10.10.10.3 10.10.10.1 Vl20 20 90 P Standby 10.10.20.3 local 10.10.20.1 Vl30 30 90 P Standby 10.10.30.3 local 10.10.30.1 Vl99 99 110 P Active local 10.10.99.3 10.10.99.1
Add standby 10 track GigabitEthernet1/0/24 30 to CORE-1's VLAN 10 and 99 groups (and the mirror on CORE-2). If a core loses its routed uplink to EDGE, its priority drops by 30 and the other core — whose uplink still works — takes over the gateway. Without tracking, a core with a dead uplink happily stays HSRP-active and blackholes half your traffic across Po1. This is part 9 and part 10 meeting in one line of config.
05
EDGE owns the internet: routed /30s to each core, static routes to the VLANs via both cores, DHCP pools for every subnet, and PAT overload on the outside interface.
EDGE(config)# interface GigabitEthernet0/0 EDGE(config-if)# ip address 203.0.113.2 255.255.255.252 EDGE(config-if)# ip nat outside EDGE(config)# interface GigabitEthernet0/1 EDGE(config-if)# ip address 10.255.0.1 255.255.255.252 EDGE(config-if)# ip nat inside EDGE(config)# interface GigabitEthernet0/2 EDGE(config-if)# ip address 10.255.0.5 255.255.255.252 EDGE(config-if)# ip nat inside # Default out; VLAN subnets reachable via EITHER core (ECMP pairs) EDGE(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1 EDGE(config)# ip route 10.10.0.0 255.255.0.0 10.255.0.2 EDGE(config)# ip route 10.10.0.0 255.255.0.0 10.255.0.6 # Cores need the way back up (on each core): CORE-1(config)# ip route 0.0.0.0 0.0.0.0 10.255.0.1 CORE-2(config)# ip route 0.0.0.0 0.0.0.0 10.255.0.5 # One DHCP pool per VLAN — gateway is the HSRP VIP, never a real SVI EDGE(config)# ip dhcp excluded-address 10.10.10.1 10.10.10.10 EDGE(config)# ip dhcp pool STAFF EDGE(dhcp-config)# network 10.10.10.0 255.255.255.0 EDGE(dhcp-config)# default-router 10.10.10.1 EDGE(dhcp-config)# dns-server 1.1.1.1 # …repeat for GUEST (10.10.20.0), VOICE (10.10.30.0), MGMT excluded entirely # PAT for everything private EDGE(config)# access-list 1 permit 10.10.0.0 0.0.255.255 EDGE(config)# ip nat inside source list 1 interface GigabitEthernet0/0 overload
A staff PC broadcasts DISCOVER; the HSRP-active core relays it to EDGE from its SVI address. But the OFFER returns via EDGE's routing table, which has two equal routes — it may hand the reply to the other core. That's fine (the other core has an SVI in the same subnet and delivers it), but only because both cores carry ip helper-address and SVIs for every VLAN. Configure the relay on one core only and the lab works until the first failover, then DHCP silently dies — the kind of latent fault labs exist to teach.
06
A lab you didn't break taught you nothing. Verify the steady state, then run the three failure drills and watch each protection you configured actually earn its keep.
| Command | What steady-state should show |
|---|---|
| show etherchannel summary | Po1(SU), both members (P) — bundled and in use. |
| show spanning-tree vlan 10 | CORE-1 says "This bridge is the root"; ACC-1's port to CORE-2 is ALTN/BLK. |
| show standby brief | Active/standby split exactly per the plan table. |
| show ip route | On EDGE: two 10.10.0.0/16 routes (ECMP); on cores: one default each. |
| show ip dhcp binding | On EDGE: leases from all client VLANs. |
| show ip nat translations | Inside locals from 10.10.x.x behind 203.0.113.2. |
Power CORE-1 off (in Packet Tracer, flip the physical switch). From a staff PC, run a continuous ping to 8.8.8.8. You should lose 3–10 seconds: CORE-2 preempts HSRP for VLANs 10/99, Rapid-PVST unblocks the access uplinks to CORE-2, and EDGE's second static carries the return path. Power CORE-1 back on — preemption returns the VIPs to it, briefly dropping one or two pings again.
Delete one of the two interlink cables. show etherchannel summary now shows one member (P), one (D) — and the pings never notice. That's the whole argument for the bundle: a physical failure became a capacity event, not an outage.
This is the sneaky one. Without HSRP tracking, VLAN 10 clients still send traffic to CORE-1 (it's still HSRP active), which must detour across Po1 to CORE-2 to reach EDGE — it works, but watch traceroute grow a hop. With the tracking from section 04, CORE-1 demotes itself and the detour never happens. Do it both ways and compare traceroutes: that's the difference tracking makes, made visible.
07
The design is vendor-neutral; here's the whole build mapped to RouterOS in one table.
| This lab (Cisco) | MikroTik / RouterOS |
|---|---|
| VLANs + 802.1Q trunks | /interface bridge vlan (vlan-filtering=yes), tagged/untagged ports |
| Rapid-PVST + root primary | RSTP on the bridge, priority= per bridge (no per-VLAN trees) |
| LACP EtherChannel (Po1) | /interface bonding mode=802.3ad |
| HSRP VIP per VLAN | VRRP interface per VLAN with the same VIP idea |
| SVIs + ip routing | VLAN interfaces on the bridge with addresses — routing is always on |
| ip helper-address | /ip dhcp-relay |
| PAT overload on EDGE | /ip firewall nat action=masquerade |
Use the 3650-24PS for the cores (it does ip routing, HSRP, and LACP), the 2960 for access, and the 2911 for EDGE. PT's 3650 names ports GigabitEthernet1/0/x — the configs above already use that scheme. Two PT quirks: HSRP tracking accepts interface tracking but not the track-object syntax from part 10, and spanning-tree vlan X root primary is supported while some show spanning-tree detail lines render slightly differently than real IOS. Neither changes the design.
Takeaways
NOCTIS designs and builds redundant campus networks for hotels, clinics, and offices across Crete — documented addressing plans, aligned STP/HSRP, and failure drills run before handover, on Cisco or MikroTik.
Book a Discovery Call →